5a10dd98c459f3152c26c8227ef10000e227b3f1cd38fa6eda6f94478387f42a

Sharing

Copy URL Twitter E-mail

General

Target

5a10dd98c459f3152c26c8227ef10000e227b3f1cd38fa6eda6f94478387f42a
Size

1.1MB
MD5

4fbd8aa2bf69dfe1e458857146077fa5
SHA1

72b285060915129dd9c3a7606bf0a56c9fc1622d
SHA256

5a10dd98c459f3152c26c8227ef10000e227b3f1cd38fa6eda6f94478387f42a
SHA512

31c88a9ebaa4d4e434b0b7e42cc861d80c1b88a57d1028238959161670e5852e7d1724959954fac6827e874d33af3b8344f0fff67beccebaea05565221ab6afc
SSDEEP

24576:x1HfA6qXoxXOjxL9JpUnZj+7bM2ZS1cITbc5dqhc6knyg9Zh:KOXg9J2V12kcYbc54iXzh

Score

N/A

Malware Config

Signatures

Files

5a10dd98c459f3152c26c8227ef10000e227b3f1cd38fa6eda6f94478387f42a
.zip
NI软件卸载工具.exe
.exe windows x86

e02091a10db1d61e51444b0370bcf7d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:7f:e1:03:52:fd:67:2b:df:df:21:e6:91:3b:94:10
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/03/2013, 00:00

Not After

25/06/2016, 23:59

Subject

CN=National Instruments Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bc:39:d5:bb:f7:3f:f2:4b:b5:77:e3:d6:26:ed:b5:35:40:8f:04:98
Signer

Actual PE Digest

bc:39:d5:bb:f7:3f:f2:4b:b5:77:e3:d6:26:ed:b5:35:40:8f:04:98

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=National Instruments Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

31/07/2014, 20:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msi

ord8
ord118
ord125
ord171
ord159
ord92
ord160
ord190
ord16
ord115
ord141
ord137
ord113
ord111
ord88
ord205
ord48
ord32
ord158
ord169
ord70

mpr

WNetGetUserW
WNetAddConnection2W
WNetGetConnectionW
WNetGetResourceInformationW

shlwapi

PathIsUNCW
PathIsNetworkPathW
PathFileExistsW

kernel32

GetCurrentProcessId
LoadLibraryExW
VirtualQuery
RemoveDirectoryW
GetUserDefaultLCID
CreateDirectoryW
GetTickCount
GetUserDefaultLangID
QueryPerformanceCounter
QueryPerformanceFrequency
InterlockedCompareExchange
HeapFree
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
WriteConsoleW
GetFileType
GetStdHandle
SetEnvironmentVariableW
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
ExitThread
HeapSize
ExitProcess
GetSystemTimeAsFileTime
GetDriveTypeA
GetTimeZoneInformation
GetCPInfo
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
SetStdHandle
CreateFileA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
SetEnvironmentVariableA
GetProcessHeap
WritePrivateProfileSectionW
DeleteFileW
LoadResource
FindResourceExW
EnumResourceLanguagesW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetVersionExW
GetCurrentProcess
GetLastError
GetCurrentThread
FindClose
FindFirstFileW
WriteFile
SetFilePointer
CreateFileW
CloseHandle
WaitForSingleObject
CreateMutexW
ReleaseMutex
GetDriveTypeW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadLocale
MoveFileExW
GetModuleFileNameW
CreateProcessW
IsDBCSLeadByteEx
ResetEvent
CreateEventW
SetErrorMode
GetLocaleInfoW
SetLastError
LocalAlloc
LocalFree
TlsGetValue
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
TlsAlloc
TlsSetValue
LocalReAlloc
GlobalFree
TlsFree
GetProcAddress
GetModuleHandleW
InterlockedDecrement
SizeofResource
LockResource
FindResourceW
FreeLibrary
WideCharToMultiByte
lstrlenW
FormatMessageW
GlobalSize
MultiByteToWideChar
SetThreadPriority
ResumeThread
GetCurrentThreadId
SetEvent
SuspendThread
InterlockedIncrement
CompareStringW
lstrcmpA
lstrlenA
GetThreadLocale
FileTimeToSystemTime
GetVersionExA
lstrcmpW
LoadLibraryA
LoadLibraryW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GlobalFlags
MoveFileW
ReadFile
FlushFileBuffers
SetEndOfFile
GetFullPathNameW
GetModuleHandleA
InterlockedExchange
CompareStringA
FileTimeToLocalFileTime
SetFileAttributesW
GetFileAttributesW
WritePrivateProfileStringW
GetCurrentDirectoryW
Sleep
TerminateThread
GetExitCodeThread
GetTempFileNameW
GetTempPathW
SetCurrentDirectoryW
GetWindowsDirectoryW
FindNextFileW
OutputDebugStringW
FatalAppExitW
_lclose
_llseek
_lread
_lwrite
OpenFile
CreateThread

user32

SetParent
WindowFromPoint
ReleaseCapture
CreatePopupMenu
GetWindowThreadProcessId
BringWindowToTop
TranslateAcceleratorW
SetCursor
InvalidateRect
PostQuitMessage
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextW
TabbedTextOutW
FillRect
DestroyMenu
InflateRect
DestroyIcon
GetDesktopWindow
ClientToScreen
SetCapture
LoadStringW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
SetFocus
SetCursorPos
SetActiveWindow
GetUpdateRgn
CreateDialogParamW
DrawFocusRect
DestroyAcceleratorTable
CreateAcceleratorTableW
DestroyCursor
LoadImageW
PostThreadMessageW
MsgWaitForMultipleObjects
CloseClipboard
ExitWindowsEx
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
GetClientRect
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
IsClipboardFormatAvailable
OpenClipboard
ChildWindowFromPoint
DrawFrameControl
DrawIconEx
IsZoomed
DrawIcon
GetUpdateRect
GetIconInfo
CreateIconIndirect
SetMenuItemInfoW
DrawMenuBar
CreateMenu
SetClipboardData
DefFrameProcW
TranslateMDISysAccel
DefMDIChildProcW
RedrawWindow
DrawEdge
DrawStateW
DdeUninitialize
DdeQueryStringW
DdeGetLastError
DdeDisconnect
DdeClientTransaction
DdeCreateDataHandle
DdeFreeDataHandle
DdeGetData
DdeCreateStringHandleW
DdeInitializeW
DdeNameService
DdeConnect
ScreenToClient
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
DefWindowProcW
CopyRect
DdePostAdvise
GetParent
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
GetDC
DrawTextExW
ReleaseDC
SendMessageW
PeekMessageW
TranslateMessage
PtInRect
GetMenu
SetWindowPos
OffsetRect
SystemParametersInfoA
MessageBoxW
CallWindowProcW
GetWindowLongW
SetWindowLongW
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetSystemMetrics
GetSysColor
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetActiveWindow
GetKeyState
GetCursorPos
ValidateRect
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetForegroundWindow
DispatchMessageW

gdi32

DeleteEnhMetaFile
CopyEnhMetaFileW
CreatePalette
GetDIBits
CreateDIBitmap
CreateICW
SetBrushOrgEx
RealizePalette
MaskBlt
Ellipse
RoundRect
Rectangle
Polyline
Polygon
SetPixel
Pie
Arc
ExtFloodFill
GetTextColor
CreateBrushIndirect
GetTextExtentPointW
GetTextMetricsW
GetBkColor
PatBlt
GetMapMode
CreateCompatibleBitmap
StretchDIBits
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
SelectPalette
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
GetPixel
CreateRectRgn
SelectClipRgn
MoveToEx
LineTo
IntersectClipRect
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
ExtTextOutW
BitBlt
CreateCompatibleDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
GetStockObject
SelectObject
CreateFontIndirectW
GetObjectW
TranslateCharsetInfo

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

comdlg32

ChooseFontW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegEnumKeyExW
InitiateSystemShutdownExW
RegOpenCurrentUser
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW

shell32

ExtractIconW
SHGetFolderPathW
DragQueryPoint
DragFinish
SHFileOperationW
DragAcceptFiles
DragQueryFileW

ole32

CoCreateInstance
ReleaseStgMedium
CoInitializeEx
OleInitialize
OleUninitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleSetClipboard
OleFlushClipboard
OleGetClipboard
CoUninitialize

oleaut32

VariantInit
VariantChangeType
VariantClear

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

ws2_32

closesocket

oleacc

CreateStdAccessibleObject
LresultFromObject

comctl32

ord17
CreateStatusWindowW
ImageList_Destroy
ImageList_Create
ImageList_Add

Exports

Exports

NI_MetaToolbox_MetaOutput_GetSharedGlobalData

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 799KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 214KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e02091a10db1d61e51444b0370bcf7d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

1e:7f:e1:03:52:fd:67:2b:df:df:21:e6:91:3b:94:10Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

bc:39:d5:bb:f7:3f:f2:4b:b5:77:e3:d6:26:ed:b5:35:40:8f:04:98Signer

Signature Validations

Verification

31/07/2014, 20:07 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

msi

mpr

shlwapi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

wtsapi32

ws2_32

oleacc

comctl32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 799KB - Virtual size: 799KB

.data Size: 214KB - Virtual size: 278KB

.rsrc Size: 446KB - Virtual size: 446KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

1e:7f:e1:03:52:fd:67:2b:df:df:21:e6:91:3b:94:10
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

bc:39:d5:bb:f7:3f:f2:4b:b5:77:e3:d6:26:ed:b5:35:40:8f:04:98
Signer

31/07/2014, 20:07
Valid: false

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 799KB - Virtual size: 799KB

.data
Size: 214KB - Virtual size: 278KB

.rsrc
Size: 446KB - Virtual size: 446KB